Remote monitoring and safeguards established by the Workers’ Statute and by the Privacy Code

The Court of Cassation, with judgement No. 18302 dated 19 September 2016, stepped in to settle a dispute between the "Istituto Poligrafico e Zecca dello Stato" (State Mint and Polygraphic Institute) and the Privacy Authority. In the specific case, the Privacy Authority, by order dated 21 July 2011, prohibited the Institute to store and categorize employees’ data related to e-mail messages sent and received, Internet browsing information, and telephone calls made. According to the Privacy Authority, such data had been collected in breach of Articles 4 and 8 of the Workers’ Statute. The Institute filed an appeal at the Court of Rome, which, however rejected it. Upon the decision of the Court, the Institute filed its appeal at the Court of Cassation. And the Court of Cassation, while confirming the observations made by the Privacy Authority, stated that, on the matter of remote monitoring, a fair balance must be found between the rights of the employer (in particular that of the free economic initiative) and the protection of workers’ rights, primarily the right to privacy. A balance that, according to the Court, was provided specifically in Articles 4 and 8 of the Workers’ Statute. In fact, article 4 has the purpose of ensuring that remote monitoring of the work performed, even if just potential, is protected by procedural safeguards regardless of the purpose for which it is ordered. And the art. 8 forbids the employer to "conduct investigations, even through third parties, on the political, religious or trade union opinions of the worker, as well as on facts not relevant to the professional role of the worker". Therefore, acquiring and storing data that contain (or that may contain) information of such kind, is in the opinion of the Court, proof of the prohibited conduct, translating into an unauthorized investigation on the opinions and conduct of the employee, even if the data is not subsequently used. Last but not least, the Supreme Court emphasized the need to provide the workers with a specific Privacy Policy Information Statement, such as to satisfy the requirements of Article 13 of Legislative Decree No. 196/2003. A decision which, although mainly concerning the interpretation of Article 4 of the Workers’ Statute prior to the amendments introduced by Legislative Decree No. 151/2015, finds full correspondence and applicability also in the new formulation.